<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>Hi all,<br>
<br>
So I am messing around with xbits in suricata and have created two custom rules:<br>
<br>
</p>
<div>alert ip any any -> any any (msg:"CUSTOM XBITS!"; \</div>
<div>xbits:set, testthisbit, track ip_src, expire 360; sid:5000000001;)</div>
<div><br>
</div>
<div>alert ip any any -> any any (msg:"XBITS!"; \</div>
<div>xbits:isset, testthisbit, track ip_src; sid:5000000002;)</div>
<div><br>
</div>
My understanding is that the 'expire' keyword expires the set xbit after the time specified (6 minutes) yet after that time I am still getting alerts based on that xbit. How exactly does the 'expire' keyword work? How can I get an alert to stop alerting after
a certain time using xbits?<br>
<br>
Thanks
<p></p>
<br>
<br>
<div style="color: rgb(0, 0, 0);">
<div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Oisf-users <oisf-users-bounces@lists.openinfosecfoundation.org> on behalf of Victor Julien <lists@inliniac.net><br>
<b>Sent:</b> Thursday, October 13, 2016 10:37 AM<br>
<b>To:</b> oisf-users@lists.openinfosecfoundation.org<br>
<b>Subject:</b> Re: [Oisf-users] whitelist with timeout?</font>
<div> </div>
</div>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">On 12-10-16 20:41, John Devine wrote:<br>
> thanks for your input. That's the path I'm going down at the moment,<br>
> creating my own custom rules file. The key piece I need to know is if<br>
> there is timeout functionality on the rules and where, if at all, does<br>
> suricata keep track of what it has blocked. I want to be able to see an<br>
> IP that was blocked by suricata, unblock it "for now" (not whitelist it<br>
> entirely) but have it alert again if it generates bad traffic in the future.<br>
<br>
Suricata has no automatic built-in blacklist/whitelist and doesn't keep<br>
track of drops. You can add something like it yourself through the<br>
rules. Below is an example of rules incoming to my SSH server.<br>
<br>
The first 2 rules match on a SSH software version often used in bots.<br>
They drop the traffic and create an 'xbit' 'badssh' for the source ip.<br>
It expired in an hour.<br>
<br>
drop ssh any any -> $MYSERVER 22 (msg:"DROP libssh incoming"; \<br>
flow:to_server,established; ssh.softwareversion:"libssh"; \<br>
xbits:set, badssh, track ip_src, expire 3600; sid:4000000005;)<br>
drop ssh any any -> $MYSERVER 22 (msg:"DROP libssh incoming"; \<br>
flow:to_server,established; ssh.softwareversion:"PUTTY"; \<br>
xbits:set, badssh, track ip_src, expire 3600; sid:4000000007;)<br>
<br>
Then I have a rule that simply drops any incoming traffic to that server<br>
that is on that 'badssh' list. *<br>
<br>
drop ssh any any -> $MYSERVER 22 (msg:"DROP BLACKLISTED"; \<br>
xbits:isset, badssh, track ip_src; sid:4000000006;)<br>
<br>
*) Technically it works the other way around, it is stored in a host<br>
table where per host information about which bits are set is stored.<br>
<br>
You can create your own whitelist/blacklist logic with timeouts using<br>
the xbits keyword.<br>
<br>
Cheers,<br>
Victor<br>
<br>
> <br>
> <br>
> <br>
> ------------------------------------------------------------------------<br>
> *From:* Cooper F. Nelson <cnelson@ucsd.edu><br>
> *Sent:* Wednesday, October 12, 2016 1:21 PM<br>
> *To:* John Devine; oisf-users@lists.openinfosecfoundation.org<br>
> *Subject:* Re: [Oisf-users] whitelist with timeout?<br>
> <br>
> Sort of.<br>
> <br>
> What you could do is create pass rules to whitelist the IPs and then<br>
> store them in a separate rules file, like 'pass.rules'.<br>
> <br>
> You could then have a separate process to add/remove pass rules in this<br>
> file via cron or some other mechanism, then trigger a rule reload on the<br>
> suricata process.<br>
> <br>
> -Coop<br>
> <br>
> On 10/12/2016 5:49 AM, John Devine wrote:<br>
>> Hi all,<br>
>> <br>
>> Quick question regarding suricata: is it possible to whitelist IPs with a specific timeout in suricata?<br>
>> <br>
>> Thanks<br>
>> <br>
>> <br>
>> <br>
>> _______________________________________________<br>
>> Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>
>> Site: <a href="http://suricata-ids.org" id="LPlnk16509" previewremoved="true">
http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" id="LPlnk575437" previewremoved="true">
http://suricata-ids.org/support/</a>
<div id="LPBorder_GT_14767385509970.8296329150673476" style="margin-bottom: 20px; overflow: auto; width: 100%; text-indent: 0px;">
<table id="LPContainer_14767385509920.3873485019191887" cellspacing="0" style="width: 90%; position: relative; overflow: auto; padding-top: 20px; padding-bottom: 20px; margin-top: 20px; border-top-width: 1px; border-top-style: dotted; border-top-color: rgb(200, 200, 200); border-bottom-width: 1px; border-bottom-style: dotted; border-bottom-color: rgb(200, 200, 200); background-color: rgb(255, 255, 255);">
<tbody>
<tr valign="top" style="border-spacing: 0px;">
<td id="ImageCell_14767385509930.13052238581697218" colspan="1" style="width: 250px; position: relative; display: table-cell; padding-right: 20px;">
<div id="LPImageContainer_14767385509930.34579308638635564" style="height: 200px; position: relative; margin: auto; display: table; width: 200px; background-color: rgb(255, 255, 255);">
<a id="LPImageAnchor_14767385509930.911990006999819" href="http://suricata-ids.org/support/" target="_blank" style="display: table-cell; text-align: center;"><img aria-label="Preview image with link selected. Double-tap to open the link." id="LPThumbnailImageID_14767385509940.5842458052329054" style="display: inline-block; max-width: 250px; max-height: 250px; height: 200px; width: 200px; border-width: 0px; vertical-align: bottom;" width="200" height="200" src="https://secure.gravatar.com/blavatar/b35fe77e09a7541f738f500f4db6b857?s=200&ts=1476738549"></a></div>
</td>
<td id="TextCell_14767385509940.3715553515965597" colspan="2" style="vertical-align: top; position: relative; padding: 0px; display: table-cell;">
<div id="LPRemovePreviewContainer_14767385509940.32176118540693066"></div>
<div id="LPTitle_14767385509940.8589685954929271" style="top: 0px; color: rgb(0, 120, 215); font-weight: normal; font-size: 21px; font-family: wf_segoe-ui_light, "Segoe UI Light", "Segoe WP Light", "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; line-height: 21px;">
<a id="LPUrlAnchor_14767385509950.10495663335893246" href="http://suricata-ids.org/support/" target="_blank" style="text-decoration: none;">Support</a></div>
<div id="LPMetadata_14767385509950.35918427605221015" style="margin: 10px 0px 16px; color: rgb(102, 102, 102); font-weight: normal; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-size: 14px; line-height: 14px;">
suricata-ids.org</div>
<div id="LPDescription_14767385509960.4994859415931743" style="display: block; color: rgb(102, 102, 102); font-weight: normal; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-size: 14px; line-height: 20px; max-height: 100px; overflow: hidden;">
FAQ A list of frequently asked questions (and their answers) is available here: Frequently Asked Questions Training Training options are now available: training Mailinglists Several users and devel…</div>
</td>
</tr>
</tbody>
</table>
</div>
<br>
<div id="LPBorder_GT_14767384918560.5280477161333186" style="margin-bottom: 20px; overflow: auto; width: 100%; text-indent: 0px;">
<table id="LPContainer_14767384918480.6796999258053928" cellspacing="0" style="width: 90%; position: relative; overflow: auto; padding-top: 20px; padding-bottom: 20px; margin-top: 20px; border-top-width: 1px; border-top-style: dotted; border-top-color: rgb(200, 200, 200); border-bottom-width: 1px; border-bottom-style: dotted; border-bottom-color: rgb(200, 200, 200); background-color: rgb(255, 255, 255);">
<tbody>
<tr valign="top" style="border-spacing: 0px;">
<td id="ImageCell_14767384918500.9282153544279104" colspan="1" style="width: 250px; position: relative; display: table-cell; padding-right: 20px;">
<div id="LPImageContainer_14767384918500.8033209251891102" style="height: 200px; position: relative; margin: auto; display: table; width: 200px; background-color: rgb(255, 255, 255);">
<a id="LPImageAnchor_14767384918510.888550833083221" href="http://suricata-ids.org/" target="_blank" style="display: table-cell; text-align: center;"><img aria-label="Preview image with link selected. Double-tap to open the link." id="LPThumbnailImageID_14767384918510.055077200313194075" width="200" height="200" style="display: inline-block; max-width: 250px; max-height: 250px; height: 200px; width: 200px; border-width: 0px; vertical-align: bottom;" src="https://secure.gravatar.com/blavatar/b35fe77e09a7541f738f500f4db6b857?s=200&ts=1476738472"></a></div>
</td>
<td id="TextCell_14767384918520.2704160413689294" colspan="2" style="vertical-align: top; position: relative; padding: 0px; display: table-cell;">
<div id="LPRemovePreviewContainer_14767384918520.9940307480736339"></div>
<div id="LPTitle_14767384918530.3505716749542038" style="top: 0px; color: rgb(0, 120, 215); font-weight: normal; font-size: 21px; font-family: wf_segoe-ui_light, "Segoe UI Light", "Segoe WP Light", "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; line-height: 21px;">
<a id="LPUrlAnchor_14767384918530.09187921910083019" href="http://suricata-ids.org/" target="_blank" style="text-decoration: none;">Suricata</a></div>
<div id="LPMetadata_14767384918540.6467658482187515" style="margin: 10px 0px 16px; color: rgb(102, 102, 102); font-weight: normal; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-size: 14px; line-height: 14px;">
suricata-ids.org</div>
<div id="LPDescription_14767384918550.9073773294673038" style="display: block; color: rgb(102, 102, 102); font-weight: normal; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-size: 14px; line-height: 20px; max-height: 100px; overflow: hidden;">
Open Source IDS / IPS / NSM engine</div>
</td>
</tr>
</tbody>
</table>
</div>
<br>
<br>
> <<a href="http://suricata-ids.org/support/" id="LPlnk751408" previewremoved="true">http://suricata-ids.org/support/</a>>
<div id="LPBorder_GT_14767385523410.40244122795760506" style="margin-bottom: 20px; overflow: auto; width: 100%; text-indent: 0px;">
<table id="LPContainer_14767385523370.2694312598958555" cellspacing="0" style="width: 90%; position: relative; overflow: auto; padding-top: 20px; padding-bottom: 20px; margin-top: 20px; border-top-width: 1px; border-top-style: dotted; border-top-color: rgb(200, 200, 200); border-bottom-width: 1px; border-bottom-style: dotted; border-bottom-color: rgb(200, 200, 200); background-color: rgb(255, 255, 255);">
<tbody>
<tr valign="top" style="border-spacing: 0px;">
<td id="ImageCell_14767385523380.7562862605042455" colspan="1" style="width: 250px; position: relative; display: table-cell; padding-right: 20px;">
<div id="LPImageContainer_14767385523380.5866230004986641" style="height: 200px; position: relative; margin: auto; display: table; width: 200px; background-color: rgb(255, 255, 255);">
<a id="LPImageAnchor_14767385523390.5113306741887897" href="http://suricata-ids.org/support/" target="_blank" style="display: table-cell; text-align: center;"><img aria-label="Preview image with link selected. Double-tap to open the link." id="LPThumbnailImageID_14767385523390.9841617135370324" width="200" height="200" style="display: inline-block; max-width: 250px; max-height: 250px; height: 200px; width: 200px; border-width: 0px; vertical-align: bottom;" src="https://secure.gravatar.com/blavatar/b35fe77e09a7541f738f500f4db6b857?s=200&ts=1476738551"></a></div>
</td>
<td id="TextCell_14767385523390.6433257826211689" colspan="2" style="vertical-align: top; position: relative; padding: 0px; display: table-cell;">
<div id="LPRemovePreviewContainer_14767385523390.33772272434969386"></div>
<div id="LPTitle_14767385523390.12848203636785782" style="top: 0px; color: rgb(0, 120, 215); font-weight: normal; font-size: 21px; font-family: wf_segoe-ui_light, "Segoe UI Light", "Segoe WP Light", "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; line-height: 21px;">
<a id="LPUrlAnchor_14767385523400.4290357944369061" href="http://suricata-ids.org/support/" target="_blank" style="text-decoration: none;">Support</a></div>
<div id="LPMetadata_14767385523400.8169699243270117" style="margin: 10px 0px 16px; color: rgb(102, 102, 102); font-weight: normal; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-size: 14px; line-height: 14px;">
suricata-ids.org</div>
<div id="LPDescription_14767385523410.546066957492306" style="display: block; color: rgb(102, 102, 102); font-weight: normal; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-size: 14px; line-height: 20px; max-height: 100px; overflow: hidden;">
FAQ A list of frequently asked questions (and their answers) is available here: Frequently Asked Questions Training Training options are now available: training Mailinglists Several users and devel…</div>
</td>
</tr>
</tbody>
</table>
</div>
<br>
<br>
> <br>
> Support <<a href="http://suricata-ids.org/support/" id="LPlnk379646" previewremoved="true">http://suricata-ids.org/support/</a>>
<div id="LPBorder_GT_14767385510270.4839611194964746" style="margin-bottom: 20px; overflow: auto; width: 100%; text-indent: 0px;">
<table id="LPContainer_14767385510250.7080587576115314" cellspacing="0" style="width: 90%; position: relative; overflow: auto; padding-top: 20px; padding-bottom: 20px; margin-top: 20px; border-top-width: 1px; border-top-style: dotted; border-top-color: rgb(200, 200, 200); border-bottom-width: 1px; border-bottom-style: dotted; border-bottom-color: rgb(200, 200, 200); background-color: rgb(255, 255, 255);">
<tbody>
<tr valign="top" style="border-spacing: 0px;">
<td id="ImageCell_14767385510250.9676081955612597" colspan="1" style="width: 250px; position: relative; display: table-cell; padding-right: 20px;">
<div id="LPImageContainer_14767385510260.9854486268336085" style="height: 200px; position: relative; margin: auto; display: table; width: 200px; background-color: rgb(255, 255, 255);">
<a id="LPImageAnchor_14767385510260.33030840177511966" href="http://suricata-ids.org/support/" target="_blank" style="display: table-cell; text-align: center;"><img aria-label="Preview image with link selected. Double-tap to open the link." id="LPThumbnailImageID_14767385510260.2802821334285992" width="200" height="200" style="display: inline-block; max-width: 250px; max-height: 250px; height: 200px; width: 200px; border-width: 0px; vertical-align: bottom;" src="https://secure.gravatar.com/blavatar/b35fe77e09a7541f738f500f4db6b857?s=200&ts=1476738550"></a></div>
</td>
<td id="TextCell_14767385510260.47228436643762706" colspan="2" style="vertical-align: top; position: relative; padding: 0px; display: table-cell;">
<div id="LPRemovePreviewContainer_14767385510260.5038760541105543"></div>
<div id="LPTitle_14767385510260.27043613885817597" style="top: 0px; color: rgb(0, 120, 215); font-weight: normal; font-size: 21px; font-family: wf_segoe-ui_light, "Segoe UI Light", "Segoe WP Light", "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; line-height: 21px;">
<a id="LPUrlAnchor_14767385510260.5614342468900946" href="http://suricata-ids.org/support/" target="_blank" style="text-decoration: none;">Support</a></div>
<div id="LPMetadata_14767385510260.41736076785265697" style="margin: 10px 0px 16px; color: rgb(102, 102, 102); font-weight: normal; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-size: 14px; line-height: 14px;">
suricata-ids.org</div>
<div id="LPDescription_14767385510270.009309774457267439" style="display: block; color: rgb(102, 102, 102); font-weight: normal; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-size: 14px; line-height: 20px; max-height: 100px; overflow: hidden;">
FAQ A list of frequently asked questions (and their answers) is available here: Frequently Asked Questions Training Training options are now available: training Mailinglists Several users and devel…</div>
</td>
</tr>
</tbody>
</table>
</div>
<br>
<br>
> suricata-ids.org<br>
> FAQ A list of frequently asked questions (and their answers) is<br>
> available here: Frequently Asked Questions Training Training options are<br>
> now available: training Mailinglists Several users and devel…<br>
> <br>
> <br>
> <<a href="http://suricata-ids.org/" id="LPlnk943113" previewremoved="true">http://suricata-ids.org/</a>>
<div id="LPBorder_GT_14767386104560.010523444728834264" style="margin-bottom: 20px; overflow: auto; width: 100%; text-indent: 0px;">
<table id="LPContainer_14767386104520.9991177096767381" cellspacing="0" style="width: 90%; position: relative; overflow: auto; padding-top: 20px; padding-bottom: 20px; margin-top: 20px; border-top-width: 1px; border-top-style: dotted; border-top-color: rgb(200, 200, 200); border-bottom-width: 1px; border-bottom-style: dotted; border-bottom-color: rgb(200, 200, 200); background-color: rgb(255, 255, 255);">
<tbody>
<tr valign="top" style="border-spacing: 0px;">
<td id="ImageCell_14767386104530.38983007071832687" colspan="1" style="width: 250px; position: relative; display: table-cell; padding-right: 20px;">
<div id="LPImageContainer_14767386104530.31098472512489805" style="height: 200px; position: relative; margin: auto; display: table; width: 200px; background-color: rgb(255, 255, 255);">
<a id="LPImageAnchor_14767386104540.8443863507172331" href="http://suricata-ids.org/" target="_blank" style="display: table-cell; text-align: center;"><img aria-label="Preview image with link selected. Double-tap to open the link." id="LPThumbnailImageID_14767386104540.11907191045060728" width="200" height="200" style="display: inline-block; max-width: 250px; max-height: 250px; height: 200px; width: 200px; border-width: 0px; vertical-align: bottom;" src="https://secure.gravatar.com/blavatar/b35fe77e09a7541f738f500f4db6b857?s=200&ts=1476738472"></a></div>
</td>
<td id="TextCell_14767386104540.5024454314914848" colspan="2" style="vertical-align: top; position: relative; padding: 0px; display: table-cell;">
<div id="LPRemovePreviewContainer_14767386104540.06389943969751832"></div>
<div id="LPTitle_14767386104540.6749151999627059" style="top: 0px; color: rgb(0, 120, 215); font-weight: normal; font-size: 21px; font-family: wf_segoe-ui_light, "Segoe UI Light", "Segoe WP Light", "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; line-height: 21px;">
<a id="LPUrlAnchor_14767386104550.6070954833418096" href="http://suricata-ids.org/" target="_blank" style="text-decoration: none;">Suricata</a></div>
<div id="LPMetadata_14767386104550.9989790719622282" style="margin: 10px 0px 16px; color: rgb(102, 102, 102); font-weight: normal; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-size: 14px; line-height: 14px;">
suricata-ids.org</div>
<div id="LPDescription_14767386104560.9427228526813833" style="display: block; color: rgb(102, 102, 102); font-weight: normal; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-size: 14px; line-height: 20px; max-height: 100px; overflow: hidden;">
Open Source IDS / IPS / NSM engine</div>
</td>
</tr>
</tbody>
</table>
</div>
<br>
<br>
> <br>
> Suricata <<a href="http://suricata-ids.org/" id="LPlnk795740" previewremoved="true">http://suricata-ids.org/</a>><br>
> suricata-ids.org<br>
> Open Source IDS / IPS / NSM engine<br>
> <br>
> <br>
> <br>
>> List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" id="LPlnk853041" previewremoved="true">
https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
>> Suricata User Conference November 9-11 in Washington, DC: <a href="http://suricon.net" id="LPlnk785454" previewremoved="true">
http://suricon.net</a>
<div id="LPBorder_GT_14767386706540.025637218720409027" style="margin-bottom: 20px; overflow: auto; width: 100%; text-indent: 0px;">
<table id="LPContainer_14767386706520.17663934689147132" cellspacing="0" style="width: 90%; position: relative; overflow: auto; padding-top: 20px; padding-bottom: 20px; margin-top: 20px; border-top-width: 1px; border-top-style: dotted; border-top-color: rgb(200, 200, 200); border-bottom-width: 1px; border-bottom-style: dotted; border-bottom-color: rgb(200, 200, 200); background-color: rgb(255, 255, 255);">
<tbody>
<tr valign="top" style="border-spacing: 0px;">
<td id="TextCell_14767386706530.027209820329155976" colspan="2" style="vertical-align: top; position: relative; padding: 0px; display: table-cell;">
<div id="LPRemovePreviewContainer_14767386706530.40557218197375966"></div>
<div id="LPTitle_14767386706530.008346008658943083" style="top: 0px; color: rgb(0, 120, 215); font-weight: normal; font-size: 21px; font-family: wf_segoe-ui_light, "Segoe UI Light", "Segoe WP Light", "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; line-height: 21px;">
<a id="LPUrlAnchor_14767386706530.20966737149522352" href="http://suricon.net/" target="_blank" style="text-decoration: none;">2016 Conference in Washington, DC - suricon.net</a></div>
<div id="LPMetadata_14767386706530.0627628383908192" style="margin: 10px 0px 16px; color: rgb(102, 102, 102); font-weight: normal; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-size: 14px; line-height: 14px;">
suricon.net</div>
<div id="LPDescription_14767386706540.43465906653754827" style="display: block; color: rgb(102, 102, 102); font-weight: normal; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-size: 14px; line-height: 20px; max-height: 100px; overflow: hidden;">
Doug started Security Onion in 2008 to provide a comprehensive platform for intrusion detection, network security monitoring, and log management.</div>
</td>
</tr>
</tbody>
</table>
</div>
<br>
<br>
> 2016 Conference in Washington, DC - suricon.net <<a href="http://suricon.net/" id="LPlnk139639" previewremoved="true">http://suricon.net/</a>>
<div id="LPBorder_GT_14767386706420.6541594602926497" style="margin-bottom: 20px; overflow: auto; width: 100%; text-indent: 0px;">
<table id="LPContainer_14767386706400.08187285847305281" cellspacing="0" style="width: 90%; position: relative; overflow: auto; padding-top: 20px; padding-bottom: 20px; margin-top: 20px; border-top-width: 1px; border-top-style: dotted; border-top-color: rgb(200, 200, 200); border-bottom-width: 1px; border-bottom-style: dotted; border-bottom-color: rgb(200, 200, 200); background-color: rgb(255, 255, 255);">
<tbody>
<tr valign="top" style="border-spacing: 0px;">
<td id="TextCell_14767386706400.6007989628859438" colspan="2" style="vertical-align: top; position: relative; padding: 0px; display: table-cell;">
<div id="LPRemovePreviewContainer_14767386706400.8000664448531041"></div>
<div id="LPTitle_14767386706400.014341928258852832" style="top: 0px; color: rgb(0, 120, 215); font-weight: normal; font-size: 21px; font-family: wf_segoe-ui_light, "Segoe UI Light", "Segoe WP Light", "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; line-height: 21px;">
<a id="LPUrlAnchor_14767386706410.2812633608790118" href="http://suricon.net/" target="_blank" style="text-decoration: none;">2016 Conference in Washington, DC - suricon.net</a></div>
<div id="LPMetadata_14767386706410.6109166260511001" style="margin: 10px 0px 16px; color: rgb(102, 102, 102); font-weight: normal; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-size: 14px; line-height: 14px;">
suricon.net</div>
<div id="LPDescription_14767386706420.519622510103382" style="display: block; color: rgb(102, 102, 102); font-weight: normal; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-size: 14px; line-height: 20px; max-height: 100px; overflow: hidden;">
Doug started Security Onion in 2008 to provide a comprehensive platform for intrusion detection, network security monitoring, and log management.</div>
</td>
</tr>
</tbody>
</table>
</div>
<br>
<br>
> suricon.net<br>
> Doug started Security Onion in 2008 to provide a comprehensive platform<br>
> for intrusion detection, network security monitoring, and log management.<br>
> <br>
> <br>
> <br>
>> <br>
> <br>
> <br>
> -- <br>
> Cooper Nelson<br>
> Network Security Analyst<br>
> UCSD ITS Security Team<br>
> cnelson@ucsd.edu x41042<br>
> <br>
> <br>
> <br>
> _______________________________________________<br>
> Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>
> Site: <a href="http://suricata-ids.org" id="LPlnk515748" previewremoved="true">
http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" id="LPlnk494712" previewremoved="true">
http://suricata-ids.org/support/</a>
<div id="LPBorder_GT_14767387321790.7138898011261523" style="margin-bottom: 20px; overflow: auto; width: 100%; text-indent: 0px;">
<table id="LPContainer_14767387321730.4705410168407602" cellspacing="0" style="width: 90%; position: relative; overflow: auto; padding-top: 20px; padding-bottom: 20px; margin-top: 20px; border-top-width: 1px; border-top-style: dotted; border-top-color: rgb(200, 200, 200); border-bottom-width: 1px; border-bottom-style: dotted; border-bottom-color: rgb(200, 200, 200); background-color: rgb(255, 255, 255);">
<tbody>
<tr valign="top" style="border-spacing: 0px;">
<td id="ImageCell_14767387321740.3280913073620577" colspan="1" style="width: 250px; position: relative; display: table-cell; padding-right: 20px;">
<div id="LPImageContainer_14767387321750.7205999653371848" style="height: 200px; position: relative; margin: auto; display: table; width: 200px; background-color: rgb(255, 255, 255);">
<a id="LPImageAnchor_14767387321750.08942762811440996" href="http://suricata-ids.org/support/" target="_blank" style="display: table-cell; text-align: center;"><img aria-label="Preview image with link selected. Double-tap to open the link." id="LPThumbnailImageID_14767387321750.6947402575316022" width="200" height="200" style="display: inline-block; max-width: 250px; max-height: 250px; height: 200px; width: 200px; border-width: 0px; vertical-align: bottom;" src="https://secure.gravatar.com/blavatar/b35fe77e09a7541f738f500f4db6b857?s=200&ts=1476738731"></a></div>
</td>
<td id="TextCell_14767387321750.5243060497877856" colspan="2" style="vertical-align: top; position: relative; padding: 0px; display: table-cell;">
<div id="LPRemovePreviewContainer_14767387321750.5420620697486798"></div>
<div id="LPTitle_14767387321750.5674179262835528" style="top: 0px; color: rgb(0, 120, 215); font-weight: normal; font-size: 21px; font-family: wf_segoe-ui_light, "Segoe UI Light", "Segoe WP Light", "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; line-height: 21px;">
<a id="LPUrlAnchor_14767387321770.2759304345334588" href="http://suricata-ids.org/support/" target="_blank" style="text-decoration: none;">Support</a></div>
<div id="LPMetadata_14767387321770.33259686279207434" style="margin: 10px 0px 16px; color: rgb(102, 102, 102); font-weight: normal; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-size: 14px; line-height: 14px;">
suricata-ids.org</div>
<div id="LPDescription_14767387321780.5651182488043516" style="display: block; color: rgb(102, 102, 102); font-weight: normal; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-size: 14px; line-height: 20px; max-height: 100px; overflow: hidden;">
FAQ A list of frequently asked questions (and their answers) is available here: Frequently Asked Questions Training Training options are now available: training Mailinglists Several users and devel…</div>
</td>
</tr>
</tbody>
</table>
</div>
<br>
<div id="LPBorder_GT_14767386707700.4367383368273552" style="margin-bottom: 20px; overflow: auto; width: 100%; text-indent: 0px;">
<table id="LPContainer_14767386707660.31910600844988024" cellspacing="0" style="width: 90%; position: relative; overflow: auto; padding-top: 20px; padding-bottom: 20px; margin-top: 20px; border-top-width: 1px; border-top-style: dotted; border-top-color: rgb(200, 200, 200); border-bottom-width: 1px; border-bottom-style: dotted; border-bottom-color: rgb(200, 200, 200); background-color: rgb(255, 255, 255);">
<tbody>
<tr valign="top" style="border-spacing: 0px;">
<td id="ImageCell_14767386707670.15217588997762155" colspan="1" style="width: 250px; position: relative; display: table-cell; padding-right: 20px;">
<div id="LPImageContainer_14767386707670.42547873738609665" style="height: 200px; position: relative; margin: auto; display: table; width: 200px; background-color: rgb(255, 255, 255);">
<a id="LPImageAnchor_14767386707670.218384020197268" href="http://suricata-ids.org/" target="_blank" style="display: table-cell; text-align: center;"><img aria-label="Preview image with link selected. Double-tap to open the link." id="LPThumbnailImageID_14767386707670.8672230676294543" width="200" height="200" style="display: inline-block; max-width: 250px; max-height: 250px; height: 200px; width: 200px; border-width: 0px; vertical-align: bottom;" src="https://secure.gravatar.com/blavatar/b35fe77e09a7541f738f500f4db6b857?s=200&ts=1476738472"></a></div>
</td>
<td id="TextCell_14767386707680.4704487815392828" colspan="2" style="vertical-align: top; position: relative; padding: 0px; display: table-cell;">
<div id="LPRemovePreviewContainer_14767386707680.3320629929032717"></div>
<div id="LPTitle_14767386707680.516206342942106" style="top: 0px; color: rgb(0, 120, 215); font-weight: normal; font-size: 21px; font-family: wf_segoe-ui_light, "Segoe UI Light", "Segoe WP Light", "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; line-height: 21px;">
<a id="LPUrlAnchor_14767386707690.6680337805778691" href="http://suricata-ids.org/" target="_blank" style="text-decoration: none;">Suricata</a></div>
<div id="LPMetadata_14767386707690.9709033771757043" style="margin: 10px 0px 16px; color: rgb(102, 102, 102); font-weight: normal; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-size: 14px; line-height: 14px;">
suricata-ids.org</div>
<div id="LPDescription_14767386707690.0925814119836279" style="display: block; color: rgb(102, 102, 102); font-weight: normal; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-size: 14px; line-height: 20px; max-height: 100px; overflow: hidden;">
Open Source IDS / IPS / NSM engine</div>
</td>
</tr>
</tbody>
</table>
</div>
<br>
<br>
> List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" id="LPlnk770001" previewremoved="true">
https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
> Suricata User Conference November 9-11 in Washington, DC: <a href="http://suricon.net" id="LPlnk789787" previewremoved="true">
http://suricon.net</a>
<div id="LPBorder_GT_14767387309910.48402480978906337" style="margin-bottom: 20px; overflow: auto; width: 100%; text-indent: 0px;">
<table id="LPContainer_14767387309870.003875733933453196" cellspacing="0" style="width: 90%; position: relative; overflow: auto; padding-top: 20px; padding-bottom: 20px; margin-top: 20px; border-top-width: 1px; border-top-style: dotted; border-top-color: rgb(200, 200, 200); border-bottom-width: 1px; border-bottom-style: dotted; border-bottom-color: rgb(200, 200, 200); background-color: rgb(255, 255, 255);">
<tbody>
<tr valign="top" style="border-spacing: 0px;">
<td id="TextCell_14767387309880.8948390846444487" colspan="2" style="vertical-align: top; position: relative; padding: 0px; display: table-cell;">
<div id="LPRemovePreviewContainer_14767387309880.9036090342669074"></div>
<div id="LPTitle_14767387309880.5477586405677477" style="top: 0px; color: rgb(0, 120, 215); font-weight: normal; font-size: 21px; font-family: wf_segoe-ui_light, "Segoe UI Light", "Segoe WP Light", "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; line-height: 21px;">
<a id="LPUrlAnchor_14767387309890.44154312358518255" href="http://suricon.net/" target="_blank" style="text-decoration: none;">2016 Conference in Washington, DC - suricon.net</a></div>
<div id="LPMetadata_14767387309890.02260683361495852" style="margin: 10px 0px 16px; color: rgb(102, 102, 102); font-weight: normal; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-size: 14px; line-height: 14px;">
suricon.net</div>
<div id="LPDescription_14767387309900.8941680576046349" style="display: block; color: rgb(102, 102, 102); font-weight: normal; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-size: 14px; line-height: 20px; max-height: 100px; overflow: hidden;">
Doug started Security Onion in 2008 to provide a comprehensive platform for intrusion detection, network security monitoring, and log management.</div>
</td>
</tr>
</tbody>
</table>
</div>
<br>
<br>
> <br>
<br>
<br>
-- <br>
---------------------------------------------<br>
Victor Julien<br>
<a href="http://www.inliniac.net/" id="LPlnk284183">http://www.inliniac.net/</a><br>
PGP: <a href="http://www.inliniac.net/victorjulien.asc">http://www.inliniac.net/victorjulien.asc</a><br>
---------------------------------------------<br>
<br>
_______________________________________________<br>
Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>
Site: <a href="http://suricata-ids.org">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/">
http://suricata-ids.org/support/</a><br>
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">
https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
Suricata User Conference November 9-11 in Washington, DC: <a href="http://suricon.net">
http://suricon.net</a></div>
</span></font></div>
</div>
</body>
</html>